chore(fallow): adopt fallow and fix dead-code findings

- add fallow 3.17 as workspace devDependency with fallow/fallow:fix scripts
- generate .fallowrc.json modeling pi.extensions entries, diagnostic CLI, and tools as entry points
- remove export from 4 internal-only symbols
- drop unused pi-ai dependency from pi-permission-inner-cmd

packages/pi-permission-inner-cmd/package.json

@@ -18,11 +18,9 @@
     "@gotgenes/pi-permission-system"
   ],
   "peerDependencies": {
-    "@earendil-works/pi-ai": "*",
     "@earendil-works/pi-coding-agent": "*"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "*",
     "@earendil-works/pi-coding-agent": "*",
     "@types/node": "^26.0.0",
     "typescript": "^5",

packages/pi-permission-inner-cmd/src/authorizer.ts

@@ -37,7 +37,7 @@ function isNonBlank(value: unknown): value is string {
 }
 
 /** Read a complete direct native-Bash ask from the structured prompt payload. */
-export function extractBashCommandEvidence(
+function extractBashCommandEvidence(
     details: PromptPermissionDetails,
 ): BashCommandEvidence | undefined {
     const payload = details.payload;